Online Documentation: To access the online documentation for this and other Novell products, and to get updates, see

Transcription

1

2 Legal Notices Novell, Inc. makes no representations or warranties with respect to the contents or use of this documentation, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc. reserves the right to revise this publication and to make changes to its content, at any time, without obligation to notify any person or entity of such revisions or changes. Further, Novell, Inc. makes no representations or warranties with respect to any software, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc. reserves the right to make changes to any and all parts of Novell software, at any time, without any obligation to notify any person or entity of such changes. This product may require export authorization from the U.S. Department of Commerce prior to exporting from the U.S. or Canada. Copyright 2000 Novell, Inc. All rights reserved. No part of this publication may be reproduced, photocopied, stored on a retrieval system, or transmitted without the express written consent of the publisher. U.S. Patent Nos. 5,157,663; 5,349,642; 5,553,139; 5,553,143; 5,594,863; 5,633,931; 5,671,414; 5,758,069; 5,781,724; 5,781,733; 5,818,936; 5,864,865; 5,905,860; 5,910,803; 5,925,108; 5,933,602; 5,964,872; 5,983,234; 6,002,398; 6,047,312; 6,052,724; 6,061,743; 6,067,093. Patents Pending. Novell, Inc South Novell Place Provo, UT U.S.A. Installation and Administration Guide July Online Documentation: To access the online documentation for this and other Novell products, and to get updates, see

3 Novell Trademarks ConsoleOne is a trademark of Novell, Inc. edirectory is a trademark of Novell, Inc. GroupWise is a registered trademark of Novell, Inc. in the United States and other countries. NetWare is a registered trademark of Novell, Inc. in the United States and other countries. NetWare Loadable Module and NLM are trademarks of Novell, Inc. Novell is a registered trademark of Novell, Inc. in the United States and other countries. Novell Client is a trademark of Novell, Inc. ConsoleOne is a trademark of Novell, Inc. Novell Directory Services and NDS are registered trademarks of Novell, Inc. in the United States and other countries. Novell SecretStore is a trademark of Novell, Inc. ZENworks is a trademark of Novell, Inc. Third-Party Trademarks v-go is a trademark of Passlogix, Inc. All other third-party trademarks are the property of their respective owners.

4

5 Contents Preface 9 User Comments Part I Introduction 1 Introducing Novell Single Sign-on 13 Product Overview SecretStore Single Sign-on Products Novell Single Sign-on Server Installation Programs Client Installation Programs New NDS Schema Classes SecretStore with ConsoleOne v-go Client Software Single Sign-on Connectors v-go for Novell Single Sign-on Web Application Support Windows Application Support Terminal Emulator Support Disconnected Access Administrative Override Client End User Utility Part II Installing Single Sign-on 2 Installing SecretStore on a Server 21 Installing SecretStore on NetWare NetWare 5 Requirements Procedures Next Steps Installing SecretStore on Windows NT/ Windows NT/2000 Requirements Procedures Next Steps Contents 5

6 3 Installing Single Sign-on Administrative Components 25 Administration Workstation Requirements Procedures Next Steps Upgrading to v-go for Novell Single Sign-on 27 Next Steps Installing Single Sign-on User Components 29 Client Workstation Requirements Installing User Components Using the Novell Single Sign-on CD Using ZENWorks Part III Administering Novell Single Sign-on 6 Configuring Novell Single Sign-on 33 Configuration Overview Single Sign-on NDS Objects v-go Administrative Overrides v-go General Page v-go Password Page v-go Logons Page v-go Mainframe Page Setting Up the nssosinglesignon Object Setting Up nssoapplication Objects Setting Properties for Predefined Applications Adding New Applications to v-go for Novell Single Sign-on Creating and Applying a Password Policy Security Considerations with Novell Single Sign-on 45 Enhanced Protection Feature SecretStore Lock Master Password Application Password Disconnected Workstation Authentication NICI Windows Password Cache Deleting Accounts Customizable Settings NDS Screen Saver Installation and Administration Guide

7 Part IV Using Novell Single Sign-on 8 Using the v-go Client 57 v-go Client Overview Using Logon Manager Setting Preferences Using Disconnected Mode Changing Passwords Managing Passwords 59 Using ConsoleOne to Manage SecretStore Using the Single Sign-on Manager Utility Using Single Sign-on with Internet Browsers 61 Supported Browsers Configuring Browser/Password Behavior Using Single Sign-on with Windows Applications 63 Configuring Application/Password Behavior Using Single Sign-on with Mainframe Terminal Emulators 65 Terminal Emulation Overview Special Settings IBM Personal Communications Attachmate EXTRA! 6.3 and RUMBA WRQ Reflection Hummingbird HostExplorer Using the Single Sign-on Connectors 69 Connectors Download Site Supported Applications Continuus Entrust Lotus Notes Microsoft Access PeopleSoft 7.x SQL Integrator Vantive GroupWise 5.5 Enhancement Pack A SecretStore Error Codes and Descriptions 73 B Setting Up the Security Domain Infrastructure (SDI) Key 75 Contents 7

8 8 Installation and Administration Guide

9 Preface User Comments This manual describes how to install and manage Novell Single Sign-on and v-go* for Novell Single Sign-on. For the latest product information and updates, visit the Novell Single Signon product Web page ( We want to hear your comments and suggestions about this manual and the other documentation included with the Novell Single Sign-on products. To contact us, send to or send comments to: Novell, Inc. Product Documentation MS PRV-C South Novell Place Provo, UT USA Fax Preface 9

10 10 Installation and Administration Guide

11 I Introduction This section describes the Novell Single Sign-on products. Introduction 11

12 12 Installation and Administration Guide

13 1 Introducing Novell Single Sign-on Product Overview This chapter describes the Novell Single Sign-on product line. Novell Single Sign-on software allows you to store application and Web site login information within the NDS User object. Once you ve authenticated to the network via NDS, Single Sign-on stores and retrieves the appropriate login credentials, eliminating the need to remember all the multiple passwords, etc., required for accessing password-protected applications and Web sites. SecretStore The Single Sign-on installation program extends the NDS schema to support the Novell SecretStore TM technology. When a user authenticates to NDS and launches an application, the application password is moved to the SecretStore that resides within the user s NDS User object. From then on, when the user logs into NDS and launches the application, NDS retrieves the application password from SecretStore and provides it to the application or Web site in the background. For more information on SecretStore, see the November 1999 edition of Novell Developer Notes ( 1999/november/a5frame.htm). Introducing Novell Single Sign-on 13

14 Single Sign-on Products Novell Single Sign-on Server Installation Programs Two separately licensed Single Sign-on products are available:! Novell Single Sign-on! v-go* for Novell Single Sign-on (additional purchase required) Novell Single Sign-on software contains the following:! Server installation programs for NetWare 5 and NDS edirectory TM or NDS Corporate Edition running on Windows* NT* and/or Windows 2000.! Client installation program for Windows 95/98 and Windows NT/2000 workstations.! New NDS schema classes.! SecretStore TM administration support using ConsoleOne TM.! A limited version of the v-go* client that allows single sign-on access to five Web sites and to a limited number of predefined Windows applications.! Support for Single Sign-on connectors. For NetWare, Single Sign-on is installed using the NWCONFIG utility. Specifically, the SecretStore Service NetWare Loadable Module TM (SSS.NLM) is installed, the schema is extended to support the new Single Sign-on objects, and the Security Domain Infrastructure (SDI) is initialized and/or validated. For NDS edirectory and NDS Corporate Edition running on Windows NT/ 2000, an InstallShield wizard program (SETUP.EXE) is used to install the appropriate SecretStore Service files to your NDS edirectory or NDS Corporate Edition directory, the schema is extended, and the security domain infrastructure is set up. 14 Installation and Administration Guide

15 Client Installation Programs A client workstation setup program (NSSOINSTALL.EXE) is included on the Novell Single Sign-on CD-ROM. The program allows you to choose which items to install, including the Single Sign-on client components and the client version of Novell International Cryptographic Infrastructure (NICI). ConsoleOne and the Single Sign-on snap-in for ConsoleOne can also be installed from the client workstation setup program when it is auto-run from the CD or started with an administrator-mode command line parameter. New NDS Schema Classes New schema classes are added to your NDS tree when you install Single Signon. These classes are used to instantiate Single Sign-on objects in your NDS tree for use in the administration of the Novell Single Sign-on and v-go for Novell Single Sign-on systems. The new classes are:! nssosinglesignon container! nssoapplication! nssopasswordpolicy! nssopasswordexludelist For more information on the Single Sign-on schema extensions, see Chapter 6, Configuring Novell Single Sign-on, on page 33. SecretStore with ConsoleOne SecretStore provides a secure infrastructure for storing and retrieving application credentials in NDS. All SecretStore functionality is managed using the ConsoleOne utility. SecretStore works with NICI and SDI to safely and securely store a user s single sign-on passwords. v-go Client Software Novell Single Sign-on includes a base version of v-go that provides single sign-on to five Web logons of the user s choice, as well as a number of predefined Windows applications. Introducing Novell Single Sign-on 15

16 Single Sign-on Connectors Connector software is available that provides integration between Novell Single Sign-on and other database-type applications. Application launchers and unique login windows are provided that intercept the username and password for storage in and retrieval from SecretStore. Subsequent logins to the application via the application launcher will not require users to manually enter a username and password. v-go for Novell Single Sign-on Web Application Support v-go for Novell Single Sign-on is a separately purchased and licensed product. It is installed as part of Novell Single Sign-on and runs in a limited mode until specifically enabled by the administrator. v-go for Novell Single Sign-on contains the following:! All of the functionality included in the Novell Single Sign-on product.! Unlimited single sign-on to most Web sites and Web-based applications.! Unlimited single sign-on to Windows applications.! Terminal emulator support.! Disconnected access to stored logon data.! Administrative override functionality.! Administrative utility designed for client end users. v-go for Novell Single Sign-on supports an unlimited number of Web logons using interfaces to Internet Explorer and Netscape* versions 4 and later. Most Web application logons are recognized by v-go, which can provide credentials for an automated logon, or it can prompt the user whether to create a logon entry for the current Web site. When registering at new sites, v-go can generate a strong password, store it as a Web logon entry in SecretStore, and insert the generated password into the registration form. 16 Installation and Administration Guide

17 Windows Application Support v-go for Novell Single Sign-on provides almost unlimited support for logons to Windows applications. v-go can watch for and automatically detect and respond to most logon dialog boxes. After v-go captures credentials when applications are first run, it reapplies the credentials whenever that logon dialog is detected. If an application has a recognized password change dialog, v-go will provide the old password and allow the user to choose or generate a new password. Terminal Emulator Support Disconnected Access v-go provides single sign-on support for the following HLLAPI-based terminal emulators:! Attachmate* EXTRA!*! Hummingbird HostExplorer! IBM* Personal Communications! RUMBA*! WRQ* Reflection* v-go for Novell Single Sign-on uses v-go Local Store technology to access cached secrets after the NDS authenticated session is closed. Synchronization occurs when v-go is started in the NDS connected network, whenever logon data is updated in the Local Store, and when v-go shuts down. Administrative Override Network administrators have override control to all v-go for Novell Single Sign-on functions. Introducing Novell Single Sign-on 17

18 Client End User Utility The SecretStore Manager utility allows end users to perform basic maintenance tasks on their SecretStore. This includes setting or changing the Enhanced Protection Master Password data, unlocking SecretStore, deleting unneeded or expired application secrets, and performing basic troubleshooting tests against SecretStore. Although the SecretStore Manager utility is not intended as the primary interface to Single Sign-on, it helps users manage SecretStore outside the interfaces provided by the single sign-on-enabled applications. 18 Installation and Administration Guide

19 II Installing Single Sign-on Novell Single Sign-on requires the following installation steps: 1. Install the SecretStore TM service on a NetWare 5 server or on a Windows* NT* or Windows 2000 server running NDS edirectory TM or NDS Corporate Edition. 2. Install client and administrative components on the administrator s Windows workstation. 3. Upgrade to v-go* for Novell Single Sign-on (if you purchased this product). 4. Install Single Sign-on software on users Windows client workstations. Installing Single Sign-on 19

20 20 Installation and Administration Guide

21 2 Installing SecretStore on a Server This chapter describes how to install the SecretStore TM service on a NetWare 5 server or on a Windows* NT* or Windows 2000 server running NDS edirectory TM or NDS Corporate Edition. Installing SecretStore on NetWare NetWare 5 Requirements Procedures " NetWare 5.x server " Supervisor rights to the NDS tree on the NetWare 5.x server To install SecretStore on a NetWare 5.x server: 1 Install the server version of Novell International Cryptographic Infrastructure (NICI) a At the NetWare server, insert the Novell Single Sign-on CD. 1b From the server console, load CDROM.NLM to mount the Novell Single Sign-on CD as a NetWare volume. 1c From the server console, start NWCONFIG.NLM. 1d Select Product Options > Install a Product Not Listed. 1e Highlight any path and press Enter. 1f Press F3 to enter a directory location. 1g Enter cd_volume_name:server\nici_1.5\nwserver. Installing SecretStore on a Server 21

22 1h Follow the on-screen instructions. 1i Exit NWCONFIG. 1j Shut down and restart the server. 2 Install the Novell SecretStore software. 2a At the NetWare server, insert the Novell Single Sign-on CD. 2b From the server console, load CDROM.NLM to mount the Novell Single Sign-on CD as a NetWare volume. 2c From the server console, start NWCONFIG.NLM. 2d Select Product Options > Install a Product Not Listed. 2e Highlight any path and press Enter. 2f Press F3 to enter a directory location. 2g Enter SERVER\NETWARE. 2h Follow the on-screen instructions. 2i Exit NWCONFIG. 2j Shut down and restart the server. The SecretStore service (SSS.NLM) is now added to the AUTOEXEC.NCF file and should load automatically. The schema has also been extended to accommodate the new Single Sign-on objects. Next Steps! To install the Single Sign-on administrative components, see Chapter 3, Installing Single Sign-on Administrative Components, on page 25.! To install v-go* for Novell Single Sign-on, see Chapter 4, Upgrading to v-go for Novell Single Sign-on, on page 27.! To install Single Sign-on software on user workstations, see Chapter 5, Installing Single Sign-on User Components, on page Installation and Administration Guide

23 Installing SecretStore on Windows NT/2000 Windows NT/2000 Requirements Procedures " Windows NT* Server 4.0 with Service Pack 2 or later or Windows 2000 Server " NDS edirectory or NDS Corporate Edition installed with a functioning NDS tree IMPORTANT: Make sure that the Windows NT/2000 server running NDS edirectory or NDS Corporate Edition is being used only as a server and not a Novell client. " Supervisor rights to the NDS tree on the Windows NT/2000 server To install SecretStore on a Windows NT/2000 server running NDS edirectory or NDS Corporate Edition: 1 Install the server version of NICI a Log in as user Administrator on the Windows NT/2000 server. IMPORTANT: You must be logged in as user Administrator for the NICI software to be installed correctly. 1b On the Windows NT/2000 server running NDS edirectory or NDS Corporate Edition, close all applications. 1c Insert the Novell Single Sign-on CD. Exit the auto-start client installation program if it starts. 1d Run the program NTNICIU0.EXE from the SERVER\NICI_1.5\NTSERVER directory on the Novell Single Sign-on CD. Overwrite all files. Restart the server. 1e If it is not already open, launch the NDS Services console window (NDSCONS.EXE) from the NDS edirectory or NDS Corporate Edition directory (C:\NOVELL\NDS by default) on the Windows NT/2000 server. The NICI NCP Handlers service (NICIEXT) should now start automatically. Installing SecretStore on a Server 23

24 2 Create or get the NICI tree key by running TREEKEY.BAT. TREEKEY.BAT is located in the SERVER\NICI_1.5\ TREEKEY4NT directory on the Novell Single Sign-on CD. IMPORTANT: The NICI tree key is limited to one per tree. Follow these procedures only if no key exists and this server is going to be one that creates the key. If you think you might already have a tree key installed, follow the instructions in Appendix B, Setting Up the Security Domain Infrastructure (SDI) Key, on page 75 before running the Single Sign-on installation program. 3 Once you have successfully installed the tree key, shut down and restart the server. 4 Run SETUP.EXE, located in the SERVER\NT directory on the Novell Single Sign-on CD. Follow the on-screen instructions. IMPORTANT: Make sure that the destination directory corresponds to the directory where NDS edirectory or NDS Corporate Edition resides on your Windows NT/2000 server (C:\NOVELL\NDS by default). 5 If necessary, launch the NDS Services console window (NDSCONS.EXE). If the NDS Services console window was already open, you must close and reopen the window to see the SecretStore Service (SSS). Next Steps! To install the Single Sign-on administrative components, see Chapter 3, Installing Single Sign-on Administrative Components, on page 25.! To install v-go for Novell Single Sign-on, see Chapter 4, Upgrading to v-go for Novell Single Sign-on, on page 27.! To install Single Sign-on software on user workstations, see Chapter 5, Installing Single Sign-on User Components, on page Installation and Administration Guide

25 3 Installing Single Sign-on Administrative Components This chapterdescribes how to install the client and administrative components necessary to manage Novell Single Sign-on. Administration Workstation Requirements Procedures " Windows* 95, Windows 98, Windows NT* 4.0, or Windows 2000 workstation used exclusively as a client workstation " Supervisor rights to the NDS tree where the SecretStore TM service is installed To install Single Sign-on administrative components: 1 From the client workstation, log in to the NDS tree and server where the SecretStore service is located. IMPORTANT: If you are installing on Windows NT or Windows 2000, you must be logged in as user Administrator in order for the NICI software to be installed correctly. 2 Insert the Novell Single Sign-on CD. 3 Choose the setup language. The Novell Single Sign-on Administrator Installation screen appears. 4 Determine from the box on the right of the dialog which products you need to install. Installing Single Sign-on Administrative Components 25

26 5 If not selected already, select all Client and Administrative Components and click Install. 6 Follow the on-screen instructions. Next Steps! If you purchased the additional software, see Chapter 4, Upgrading to v-go for Novell Single Sign-on, on page 27.! To install Single Sign-on software on your users workstations, see Chapter 5, Installing Single Sign-on User Components, on page Installation and Administration Guide

27 4 Upgrading to v-go for Novell Single Sign-on Next Steps v-go* for Novell Single Sign-on is a separately purchased and licensed product. It is installed as part of Novell Single Sign-on and runs in a limited mode until specifically enabled by the administrator. To enable v-go for Novell Single Sign-on: 1 From ConsoleOne TM, create an nssosinglesignon object in your NDS tree at or above the context of the users that you want to administer. 2 Edit the properties of the nssosinglesignon object that you just created to enable the v-go for NSSO product. 2a Select the v-go General property tab. 2b Check the Enable v-go for Novell Single Sign-on for All Users in This Container check box. 2c Click the Accept button on the License Agreement dialog. 2d Click Generate. 2e Click OK to apply and close the property dialog. 3 Start (or restart) v-go on the user workstation to have v-go read the updated administrative overrides from the nssosinglesingon object.! To configure your specific implementation of Single Sign-on, see Chapter 6, Configuring Novell Single Sign-on, on page 33. Upgrading to v-go for Novell Single Sign-on 27

28 28 Installation and Administration Guide

29 5 Installing Single Sign-on User Components This chapter describes how to install Novell Single Sign-on software on users Windows* client workstations. Client Workstation Requirements " Each user must have an assigned User object in the NDS tree where the SecretStore service is installed " Windows* 95, Windows 98, Windows NT* 4.0, or Windows 2000 workstation Installing User Components Using the Novell Single Sign-on CD Using ZENWorks To install Single Sign-on using the Novell Single Sign-on CD: 1 From the client workstation, log in to the NDS tree as the appropriate user. 2 Insert the Novell Single Sign-on CD. The client auto-start screen appears. 3 Follow the on-screen instructions. Single Sign-on can be distributed to user workstations via ZENworks TM. A sample.aot file is included on the Novell Single Sign-on CD. Installing Single Sign-on User Components 29

30 30 Installation and Administration Guide

31 III Administering Novell Single Sign-on This section describes administrative functions of Novell Single Sign-on. Administering Novell Single Sign-on 31

32 32 Installation and Administration Guide

33 6 Configuring Novell Single Sign-on Configuration Overview This chapter describes how to set up the Novell Single Sign-on in your NDS tree using ConsoleOne TM. Novell Single Sign-on has been designed to run out-of-the-box with little or no administrative setup. The default server and client installation options provide basic Novell Single Sign-on connector support and client capabilities. However, there are some reasons why you may want to additionally configure Novell Single Sign-on using the ConsoleOne management utility. Many advanced v-go* features are available only in the full v-go for Novell Single Sign-on product. For example, in order to administer v-go settings in NDS, support terminal emulators, permit unlimited Web logons per user, or define additional Windows applications that v-go will recognize, you must license and enable v-go for Novell Single Sign-on within ConsoleOne. If you want to define v-go recognition characteristics for undefined applications or establish application password policies to be enforced by v-go for Novell Single Sign-on, you must use the Single Sign-on ConsoleOne snap-in to create and edit these settings. Configuring Novell Single Sign-on 33

34 Single Sign-on NDS Objects When you install the SecretStore TM Service on your NetWare 5 or Windows* NT* or Windows 2000 server, the NDS schema is extended to accommodate the following additional objects:! nssosinglesignon container object! nssoapplication object! nssopasswordpolicy object! nssopasswordexcludelist object You first need to create and configure the nssosinglesignon object. The nssoapplication, nssopasswordpolicy, and nssopasswordexcludelist objects must reside in the nssosinglesignon container. Each of these objects has its own set of property pages that are accessed using ConsoleOne. v-go Administrative Overrides The nssosinglesignon object has a v-go property page that allows you to set up administrative overrides for Single Sign-on users residing within the container. Some of the options have three settings: User-Defined, Yes, and No. User- Defined leaves the choice to the end user. Yes and No are forced settings and result in disabled options in the user s preferences. There are four sub-pages on the v-go property page: General, Password, Logons, and Mainframe. v-go General Page Setting Allow for Disconnected Operations Description If checked, v-go will function even when disconnected from NDS. This is most useful for laptop users and provides single sign-on functionality to local and Web applications while away from the office. 34 Installation and Administration Guide

35 Setting Remove Local Logon Data at Shutdown Generate v-go Configuration Data Description Most useful for environments in which machine logons (but not NDS logons) are shared. If set to Yes, v-go will remove the local cache of secrets when it is shut down. v-go downloads compiled configuration data from the nssosinglesignon object at startup. This option populates the data for the attribute that contains application and password policy data. Whenever you update objects within the nssosinglesignon container, you must use Generate to update the compiled form of this data. Enable v-go for Novell Single Sign-on for All Users in This Container Import v-go Application List Checking this option and accepting the v-go for Novell Single Sign-on license agreement enables the full v-go feature set. No other administrative configuration settings are honored by v-go unless this option is set. This option (also available when you re creating this object) creates nssoapplication Windows Application (Override) objects that allow you to set policy for v-go s predefined applications. By default, Enhanced Protection is added to these application objects. To use, browse to the installation directory for v-go on your workstation (for example, C:\NOVELL\SSO\PASSLOGIX) and select the APPLIST.INI file. Configuring Novell Single Sign-on 35

36 v-go Password Page Setting Auto-Prompt Description Controls v-go s behavior when application logon events are detected for which no logon data has been stored. If turned on (or left at the default userdefined setting), v-go will prompt users whether they want to add a Logon for the detected logon. If they respond yes, the Add Logon wizard will run. If turned off, users can still add logon data by selecting Add Logon from the Single Sign-on icon on the application s title bar or from the Novell Single Signon icon in the Windows system tray. Auto-Enter Controls v-go s behavior when application logon events are detected for which logon data has been stored. If turned on (or left at the default setting), v-go will press Enter after providing the username and/or password. If turned off, v-go will simply enter the data and allow the user to make any needed modifications to the logon screen before pressing Enter. Reveal ID/Password By default, users can use the v-go My Logons interface to display saved logon details. If turned off, the reveal function is not allowed. (This setting can be controlled at the application level by setting this property on each nssoapplication object.) 36 Installation and Administration Guide

37 Setting Special Characters Description For password policy implementation, this field lets administrators define the superset of special characters that can be used in passwords for any application. (An exclude special characters setting on the nssopasswordpolicy object subtracts from this list for a given application or set of applications that reference that policy.) v-go Logons Page Setting Access Icon Display Dropdown Auto-Recognize Description Controls the display of the small Novell Single Sign-on icon that appears on the title bar of the active window. This icon provides access to v-go s Add Logon and Logon functions and is most useful if Auto-Prompt and/or Auto-Recognize are set to Off. If the Access Icon is displayed and the dropdown is turned off, clicking the Icon results in either an Add Logon or Logon event, depending on whether or not a logon exists for the application window. Controls whether or not v-go automatically provides logon data to applications for which Logons have been created. Configuring Novell Single Sign-on 37

38 v-go Mainframe Page Setting Enable Mainframe Support Default Terminal Emulator Description Can override user setting for HLLAPI terminal emulator support. Can override the user setting for choice of terminal emulator. See MFRMLIST.INI in the v-go client installation directory (C:\NOVELL\SSO\PASSLOGIX) for a list of acceptable names. Unless users workstations have more than one emulator, this setting is not necessary. Also, this setting should not be used if users being administered by this nssosinglesignon object have different emulators. NOTE: You generally don t need to override the mainframe support settings unless you want to disable support or specify which emulator is used. The v-go client will auto-detect support emulators using information located in the MFRMLIST.INI file. Setting Up the nssosinglesignon Object The nssosinglesignon object should be placed in your NDS tree at or below the context of the users you want to administer. You can place an nssosinglesignon container object anywhere in the NDS tree except at the [Root]. Ideally, the nssosinglesignon container object should be located at or above the context of the users it is intended to affect; default search behavior is used to locate the Single Sign-on object in the user s context or higher in the tree. All users in the context at or below the object are administered by a single Single Sign-on object. For example, if you want to administer Novell Single Sign-on for a username of CN=Pat.OU=Sales.O=Acme, you would place the nssosinglesignon object in the NDS tree in the Sales or Acme container objects. Placing it in the Sales Organizational Unit container object would affect all users in Sales; placing it within the Acme Organization object would affect users in Sales (unless a nssosinglesignon object also existed there). 38 Installation and Administration Guide

39 When using v-go* for Novell Single Sign-on, all Novell Single Sign-on users gain access to the v-go for Novell Single Sign-on product and, therefore, must be licensed. If you intend to upgrade only certain users to the full v-go product, Novell Single Sign-on users and v-go for Novell Single Sign-on users must be located in separate containers. Setting Up nssoapplication Objects v-go for Novell Single Sign-on supports three application types:! Windows Override (for predefined applications)! Windows (for administrator-defined applications)! Terminal Emulator (for mainframe applications) Setting Properties for Predefined Applications If you want to administratively control settings for applications supported by v-go for Novell Single Sign-on, you must create nssoapplication objects of the type Windows Application (Override). You can create these objects when creating or editing properties of the nssosinglesignon object by using the Import v-go application list option. Once the override objects are created, you can apply application and password policies to them by editing the properties of each object. By default, these objects are created with the Enhanced Protection and Allow User to Reveal Password options enabled. Adding New Applications to v-go for Novell Single Sign-on Although v-go for Novell Single Sign-on can detect and add new applications on-the-fly using the Add Logon wizard, it is usually more efficient to have the administrator do this once for all users in NDS. Using administrator-defined applications streamlines the v-go user s Add Logon experience to one in which only the username and password need be collected. For applications that aren t widely used, it may be appropriate to let this small number of users rely on v-go s full Add Logon wizard to both define the application characteristics and collect authentication information. Configuring Novell Single Sign-on 39

40 Defining Common Attributes Novell Single Sign-on provides administrative support to add Windows and mainframe applications to v-go s predefined list of applications. To add an application, you will create an nssoapplication object within the nssosinglesignon object and set recognition characteristics that allow v-go to recognize the application and subsequently associate that application with the appropriate logon information in SecretStore. To define the common attributes of an application: 1 Right-click the nssosinglesignon object. 2 Select New > Object. 3 Select nssoapplication. 4 Name the object, select Define Additional Properties, and click OK. 5 Define properties of the nssoapplication object. Setting Application ID Enable Enhanced Protection Use Enhanced Protection Application Password Description The mandatory portion of the Secret_ID field used when storing this application s secrets. If selected, this secret is protected when SecretStore is locked after an administrative password change. Select this option if the application is sensitive. This enhanced protection feature results in secrets that are stored with an application and user-specific password and can help protect the most sensitive secrets from processes running on a user s authenticated workstation. If set and implemented by v-go or a Single Sign-on-enabled application, the user will be unable to read the secret using SecretStore Manager or ConsoleOne without a Master Password. 40 Installation and Administration Guide

41 Setting Password Policy DN Allow User to Reveal Password Auto-Generate Password Description Can point to an nssopasswordpolicy object that can be used to enforce password rules when a application password change event occurs. Lets users reveal the password for this application in v-go. Unless you don t want users to be able to display their password, you should leave this option selected. If you re using a password policy (either a default policy on the nssosinglesignon object or a policy specified on the nssoapplication object), you can have v-go generate a password when the application s password change event is detected. Not all applications support this option. Defining a Windows Application 6 Determine if you want to set up a Windows application or a mainframe application. Follow the appropriate steps. To recognize a Windows application, v-go will match the Windows title bar text, module name, and username and password control IDs for newly created dialogs on the desktop with those it knows about. Defining applications in ConsoleOne adds this data to v-go s list of predefined applications. NOTE: You must be able to run v-go for Novell Single Sign-on and the application that you want to add on the administrative workstation. With ConsoleOne still up and the nssoapplication object s property page open, launch the Windows application that you want to add so that its logon dialog is displayed. If v-go prompts you to add the logon, press Cancel before proceeding. To define a Windows application: 1 In ConsoleOne, right-click the nssoapplication object and select Properties. 2 Select the Single Sign-on Application Type property page. Configuring Novell Single Sign-on 41

42 3 From the Application Type drop-down list, select Windows Application. 4 Complete the Login Settings fields. You can use the auto-detection support by clicking the icons next to the User Control ID and Password Control ID fields and then clicking on the appropriate input fields on the application s logon dialog box. You need to do this one field at a time, and it will result in the control ID fields being filled in for you. If the application doesn t use one or the other field, skip that icon. Once this step is complete, you can close the application dialog box. 5 Complete the Change Password Settings fields. This is optional and only applies to applications that present change password dialogs to the user. To set up this feature, launch the application and start the password change dialog. As in the previous step, use the auto-detection icons to complete each field that has a match in the application s password change dialog. 6 Close the object to save the updated property values. 7 Open the property page for the nssosinglesignon object and select the v-go tab. 8 Click Generate to regenerate the v-go configuration data attribute. (This attribute contains data that v-go needs from the individual application and password policy objects within the nssosinglesignon container.) NOTE: Some applications use nonstandard controls that cannot be auto-detected using the steps noted above. You can also manually enter the information in the Logon Settings and Change Password Settings fields. This information is easily obtained using a Windows spy tool such as Spy++ that ships in the Microsoft* Visual Studio development suite. Defining a Mainframe Application v-go s mainframe terminal emulator support is based on its ability to recognize a screen by looking for specific strings of data at specific screen locations. This recognition data is entered by the administrator in the Single Sign-on Application Type property page of the nssoapplication object. To define a mainframe application, you will provide row, column, and match string information that will help v-go detect the application s logon screen and indicate where the secret data should be entered. 42 Installation and Administration Guide

43 NOTE: For multi-screen logons, you can create nssoapplication objects for as many screens as may be required, as long as each screen depicts a unique event for which the same information is entered by each individual user. To define a mainframe application: 1 Launch a terminal emulator session and the mainframe application so that you can reference the logon screen in the subsequent steps. 2 In ConsoleOne, right-click the nssoapplication object and select Properties. 3 From the Application Type drop-down list, select Terminal Emulator Logon. 4 If this application logon screen requires a username (or ID), modify the [Username] entry in the Terminal Emulator Logon string list. Specify the row and column number of the first character of the input field associated with the username value. These values can be determined in most emulators by positioning the cursor (using the Tab key) to the field and referencing the row/col indicator on the session status bar. 5 If the application logon screen requires a password, repeat the process above for the [Password] field. Again, specify the row and column values for the first character of the password input field. 6 Use the Add function to create as many Match String entries as may be needed to uniquely identify this logon screen. This must be data that is static. Terminal IDs, dates, etc. should not be used as match strings. You may want to use cut-and-paste to ensure that strings are entered exactly as they appear in the application logon screen. The row and column values are for the first character in the string. 7 Close the object to save the updated property values. 8 Open the property page for the nssosinglesignon object and select the v-go tab. 9 Click Generate to regenerate the v-go configuration data attribute. (This attribute contains data that v-go needs from the individual application and password policy objects within the nssosinglesignon container.) Configuring Novell Single Sign-on 43

44 Creating and Applying a Password Policy With Novell Single Sign-on and v-go for Novell Single Sign-on, you can apply password policies to user-entered passwords in some applications that don t provide this capability natively. Because passwords are entered into v-go s logon wizard, rather than directly into the application s password change dialog, v-go can enforce password policy if it has been properly configured to detect the password change event. To set up a password policy: 1 In ConsoleOne, right-click the desired nssoapplication object. 2 Click New > Create. 3 Select the nssopasswordpolicy object. 4 Select Define Additional Properties. 5 Configure the desired password policies and behaviors. 6 Click Apply and OK. 44 Installation and Administration Guide

45 7 Security Considerations with Novell Single Sign-on This chapter describes issues related to your network security with the use of Novell Single Sign-on. Refer to the Novell Single Sign-on product Web page ( for up-to-date information on this and other important topics. Enhanced Protection Feature The Novell Single Sign-on Enhanced Protection feature set optionally enhances the security of SecretStore TM by providing additional protection for secrets stored with Enhanced Protection enabled. These features are among key security advantages provided by the patented SecretStore technology. SecretStore Lock With the Enhanced Protection option enabled for any secret in SecretStore, if the administrator changes the user s NDS password, SecretStore enters a locked state. When locked, no secrets stored with the Enhanced Protection option can be read until SecretStore is unlocked. SecretStore can only be unlocked if the last NDS password set by the end user is provided. Since an administrator should not know the user s previous NDS password, Enhanced Protection-protected secrets are kept safe. NDS and SecretStore can distinguish between user-initiated password changes and those done by an administrator; SecretStore locks only on administrator password changes and an encrypted hash of the user s previous password is updated in SecretStore only if the change was initiated by the user. Security Considerations with Novell Single Sign-on 45

46 This protection is foolproof, of course, only if the user has made an NDS password change at least once since the account was created and before Enhanced Protection-protected secrets are stored so the administrator doesn t know the previous password. This suggests that a standard practice when setting up new user objects in NDS should be to require a password change at first login. Users that have admin-equivalent rights (that is, they have supervisor rights but are not the actual network administrator) need to be careful when setting their own passwords. If a user sets a password when logged in as an adminequivalent user, his or her SecretStore will be locked. Master Password The Enhanced Protection Master Password feature provides an alternative way for users to unlock SecretStore. The Master Password feature allows users to store a persistent password and associated hint in SecretStore that can be used instead of the previous NDS password to unlock SecretStore after an administrative NDS password reset. The SecretStore Manager (SSMANAGER.EXE) provides an interface that lets users store and update the Master Password data. Then, when unlocking SecretStore, either the previous NDS password or the persistent Master Password can be used. If the user enters an incorrect password when unlocking SecretStore from the SecretStore Manager and a Master Password and Hint have been stored, the hint will be displayed to remind the user of the master password. Other interfaces that unlock SecretStore (such as those built in to the Notes and Entrust connectors) will accept the Master Password in place of the previous NDS password, but they may not be capable of displaying the hint. To set a Master Password and Hint, start SecretStore Manager from the Single Sign-on program group and select Options > Set Master Password. Alternatively, SecretStore Manager can be invoked with a command line switch (SSMANAGER.EXE /SP) that will directly launch the Set Master Password dialog and exit on completion. This capability might be useful if you want to encourage users to set their Master Password data. 46 Installation and Administration Guide

47 Application Password Application Password is an optional Enhanced Protection feature designed to secure an application s secrets from other applications running on the authenticated workstation. This optional password, stored on a per-secret basis when secrets are written, will prevent an application from reading a secret unless it can supply the correct application password on the nssoreadsecret() function call. Application Passwords are defined by the Single Sign-on-enabled application that creates the secret, and they should be unique for each application and user. They are true application secrets that will not be known by the user or by any other application. v-go for Novell Single Sign-on will use the Application Password feature when the Use Application Password option is set for that application in the Single Sign-on configuration of that application in NDS. The Application Password feature is also available to any developer of Single Sign-on-enabled applications and connectors. If secrets are stored with Application Passwords, they cannot be viewed or read by the user unless a Master Password has been stored by the user. SecretStore Manager will prompt for the Master Password when the user attempts to view a secret stored with an Application Password. Disconnected Workstation Authentication Disconnected Workstation Authentication provides an authentication service to help prevent casual and unauthorized access to a user profile on Windows 95 and Windows 98 workstations. IMPORTANT: Disconnected Workstation Authentication support is provided in Novell Client TM for Windows 95/98 version 3.30 or later. Download the latest Novell Client software at the Novell Web site ( Disconnected Workstation Authentication extends the Novell Client for Windows 95 and 98 workstations. It provides an authentication service while the computer is not connected to the network (in disconnected mode). Without this added service, users are given access to the computer without authenticating after the Novell Client determines that no network exists. Disconnected Workstation Authentication gives network administrators the ability to force the user to authenticate regardless of whether or not the computer is connected to the network. Security Considerations with Novell Single Sign-on 47